Khaled Alenazi

An issue exists where the plugin fails to validate the name, extension, or type of uploaded files before writing them to disk. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to execute code on the server.

The listing-import feature fails to validate the file types extracted from uploaded ZIP archives. This allows users with management capabilities to upload arbitrary PHP files to a publicly accessible, network-shared directory, which can lead to remote code execution (RCE), a process where an attacker executes malicious commands on the host machine.

The plugin exposes an unauthenticated CSV export script that allows the disclosure of all stored subscriber email addresses.

The front-end Forms module fails to verify if the requester is authorized to edit a targeted user account during the `update-user` action. The plugin only performs capability checks when the submitted role is administrator or super admin. If a publicly accessible front-end form is configured to target an administrator account and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite the administrator's password to take over the account. By default, the action targets the submitting user, meaning exploitation requires the form to be specifically configured to target another account.

The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as Administrator, which can lead to a full site takeover and the compromise of existing accounts.

The SmilePass Selfie Login WordPress plugin fails to perform server-side verification of the identity during the authentication process. This flaw allows unauthenticated users to bypass authentication and log in as any registered account, including those with administrator privileges.

Insufficient user capability checks on certain admin REST API routes allow users with Shop Manager privileges to install and activate arbitrary plugins from WordPress.org. The system incorrectly verifies only for a general WooCommerce management capability instead of the required installation capability.

The plugin fails to perform authentication, authorization, or nonce checks in a publicly accessible login handler. This allows unauthenticated attackers to obtain a valid session for any existing user, including administrators. By default, an attacker can gain a session as the site's original administrator account without requiring any account details.

The JSON Options WordPress plugin lacks capability checks and nonce verification on an action that executes on every request. This allows unauthenticated users to update arbitrary WordPress options. An attacker can exploit this to enable user registration and set the default role to administrator, resulting in privilege escalation and full site takeover.

The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows unauthenticated attackers to gain access to any existing user account, including those with administrator privileges, by providing the target user's email address.

The plugin fails to validate the type or name of uploaded files and does not restrict the upload action with authentication, capability, or nonce checks. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to a web-accessible directory. On servers that execute PHP from the uploads path, this can lead to remote code execution.

An issue exists where the software fails to verify user capabilities before installing and activating a plugin from a user-supplied slug via a nonce-protected AJAX action. This allows users with the Shop Manager role, who lack the necessary management capabilities, to install and activate arbitrary plugins, which can lead to remote code execution.

Insufficient validation of user input before it is processed by a PHP deserialization function allows unauthenticated attackers to inject arbitrary PHP objects. This can lead to remote code execution if a suitable gadget chain—a sequence of existing code fragments that can be leveraged for malicious purposes—is present within the installed environment.

The POUCO Import Users WordPress plugin fails to perform capability or nonce checks on AJAX actions available to unauthenticated users used for creating and updating WordPress accounts. Additionally, the plugin trusts a role value supplied by the user, which allows an unauthenticated attacker to create a new administrator account and gain full control of the site.

This issue occurs because the plugin fails to validate password-reset requests against a reset key or the identity of the requester. Additionally, it generates authentication sessions based on unverified third-party sign-in data. This allows unauthenticated attackers to reset passwords for any user or log in as any existing account, including those with administrator privileges, leading to full site takeover.

An arbitrary file upload issue exists due to missing file type validation in the upload function. The WPL I/O service endpoint is registered on the public WordPress init hook without a capability check and relies on static, plugin-seeded API credentials (`api key` and `api secret`) that are identical across all installations. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

The site-registration request handler fails to verify the identity of the requester when password authentication is disabled for the targeted account. This allows an unauthenticated attacker to obtain a valid authentication session for that account, including those with administrator privileges, by specifying the login name in a single registration request.

An authentication bypass exists that allows for administrator account takeover. The issue occurs because the `um reset password process hook()` function fails to perform server-side verification to ensure the OTP validation step was completed. Instead, it relies on a public `form nonce` nonce emitted to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page. An unauthenticated attacker can provide a controlled `username b` parameter to target any WordPress user, regardless of role, without a validated OTP session. This allows the attacker to obtain a password-reset URL in a 302 `Location` header and gain full control of the account. This requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.

The plugin fails to bind OAuth access tokens to a specific WordPress user. Consequently, the system accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools with administrator privileges, enabling actions such as arbitrary user creation and role escalation.

An issue exists where the plugin fails to validate if the membership tier submitted during public registration is among the tiers permitted by the registration form. This allows unauthenticated users to register for any published membership tier and acquire the associated user role, which could potentially grant administrator privileges if such a tier is available.